PT-2017-8482

Name of the Vulnerable Software and Affected Versions Gitlab versions 8.2.0 through 8.2.4 Gitlab versions 8.3.0 through 8.3.8 Gitlab versions 8.4.0 through 8.4.9 Gitlab versions 8.5.0 through 8.5.11 Gitlab versions 8.6.0 through 8.6.7 Gitlab version 8.7.0 Description The impersonate feature in...

Updated samba packages fix security vulnerability

Samba client code always requests a forwardable ticket when using Kerberos authentication. This means the target server, which must be in the current or trusted domain/realm, is given a valid general purpose Kerberos "Ticket Granting Ticket" TGT, which can be used to fully impersonate the...

CVE-2016-1411: Undefined Security Weakness

A vulnerability in the update functionality of Cisco AsyncOS Software for Cisco Email Security Appliance ESA, Cisco Web Security Appliance WSA, and Cisco Content Management Security Appliance SMA could allow an unauthenticated, remote attacker to impersonate the update server. More Information:...

Cisco IOS Software SSH X.509 Authentication Bypass Vulnerability (cisco-sa-20161207-ios-xe-x509)

A vulnerability in the implementation of X.509 Version 3 for SSH authentication functionality in Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to bypass authentication on an affected system. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be...

Security Bypass Vulnerability in IBM Security Guardium Database Activity Monitor

IBM Security Guardium Database Activity Monitor is a database activity monitor product from IBM USA. The product provides features such as automated controls for compliance and protection against internal and external threats. A security bypass vulnerability exists in IBM Security Guardium Databa...

CVE-2016-4407: Improper Access Control

The DSA algorithm implementation in SAP SAPCRYPTOLIB 5.555.38 does not properly check signatures, which allows remote authenticated users to impersonate arbitrary users via unspecified vectors, aka SAP Security Note 2223008...

UBUNTU-CVE-2016-3917

The fingerprint login feature in Android 6.0.1 before 2016-10-01 and 7.0 before 2016-10-01 does not track the user account during the authentication process, which allows physically proximate attackers to authenticate as an arbitrary user by leveraging lockscreen access, aka internal bug 30744668...

Microsoft Exchange Open Redirect Vulnerability

An open redirect vulnerability exists in Microsoft Exchange that could lead to spoofing. To exploit the vulnerability, an attacker could send a link that has a specially crafted URL, and convince the user to click the link. When an authenticated Exchange user clicks the link, the authenticated...

GitLab Impersonate Privilege Escalation

Exploit Title: GitLab privilege escalation via "impersonate" feature Date: 02-05-2016 Software Link: https://about.gitlab.com/ Version: 8.2.0 - 8.2.4, 8.3.0 - 8.3.8, 8.4.0 - 8.4.9, 8.5.0 - 8.5.11, 8.6.0 - 8.6.7, 8.7.0 Exploit Author: Kaimi Website: https://kaimi.ru CVE: CVE-2016-4340 Category:...

GitLab - impersonate Feature Privilege Escalation

GitLab - impersonate Feature Privilege Escalation Exploit Title: GitLab privilege escalation via "impersonate" feature Date: 02-05-2016 Software Link: https://about.gitlab.com/ Version: 8.2.0 - 8.2.4, 8.3.0 - 8.3.8, 8.4.0 - 8.4.9, 8.5.0 - 8.5.11, 8.6.0 - 8.6.7, 8.7.0 Exploit Author: Kaimi Website...

GitLab - 'impersonate' Feature Privilege Escalation

Exploit Title: GitLab privilege escalation via "impersonate" feature Date: 02-05-2016 Software Link: https://about.gitlab.com/ Version: 8.2.0 - 8.2.4, 8.3.0 - 8.3.8, 8.4.0 - 8.4.9, 8.5.0 - 8.5.11, 8.6.0 - 8.6.7, 8.7.0 Exploit Author: Kaimi Website: https://kaimi.ru CVE: CVE-2016-4340 Category:...

FreeBSD : gitlab -- privilege escalation via 'impersonate' feature (be72e773-1131-11e6-94fa-002590263bf5)

GitLab reports : During an internal code review, we discovered a critical security flaw in the 'impersonate' feature of GitLab. Added in GitLab 8.2, this feature was intended to allow an administrator to simulate being logged in as any other user. A part of this feature was not properly secured a...

gitlab -- privilege escalation via "impersonate" feature

GitLab reports: During an internal code review, we discovered a critical security flaw in the "impersonate" feature of GitLab. Added in GitLab 8.2, this feature was intended to allow an administrator to simulate being logged in as any other user. A part of this feature was not properly secured an...

CVE-2016-2118

The MS-SAMR and MS-LSAD protocol implementations in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 mishandle DCERPC connections, which allows man-in-the-middle attackers to perform protocol-downgrade attacks and impersonate users by modifying the client-server data...

CVE-2016-2118

The MS-SAMR and MS-LSAD protocol implementations in Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 mishandle DCERPC connections, which allows man-in-the-middle attackers to perform protocol-downgrade attacks and impersonate users by modifying the client-server data...

CVE-2016-0128: Undefined Security Weakness

The SAM and LSAD protocol implementations in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 do not properly establish an RPC channel, which allows man-in-the-middle attacker...

Debian DSA-3463-1 : prosody - security update

It was discovered that insecure handling of dialback keys may allow a malicious XMPP server to impersonate another server. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-3463. The text...

PT-2016-3856

Name of the Vulnerable Software and Affected Versions NTP versions prior to 4.2.8p7 Cisco IOS affected versions not specified Description The issue allows remote attackers to obtain origin timestamps and then impersonate peers. There is also a vulnerability in Cisco IOS, but details are not...

Dell Computers Contain CA Root Certificate Vulnerability

Dell personal computers using the preinstalled certificate authority CA root certificate eDellRoot contain a critical vulnerability. Exploitation of the vulnerability could allow a remote attacker to read encrypted web browser traffic HTTPS, impersonate spoof any website, or perform other attacks...

Mozilla Network Security Services 'SSL_ImplementedCiphers' Security Bypass Vulnerability

Mozilla Network Security Services is a library that provides cross-platform support for SSL, S/MIME and other Internet security standards. A security bypass vulnerability exists in Mozilla Network Security Services, which could be exploited by a remote attacker to perform a man-in-the-middle atta...